PT-2026-56536 · Npm · Liquidjs
CVSS v4.0
8.2
High
| Vector | AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
LiquidJS versions prior to 10.27.1
Description
The pop array filter at src/filters/array.ts allocates a full clone of its input array using
[...toArray(v)] without calling this.context.memoryLimit.use(...). This allows a template render, such as {{ huge array | pop }}, to allocate an O(N) clone of an attacker-influenced array that bypasses the configured memoryLimit budget.Recommendations
Update to version 10.27.1.
Exploit
Fix
Allocation of Resources Without Limits
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Liquidjs